CVE-2021-36383: 
JavaScript vulnerability analysis and mitigation

Xen Orchestra, with xo-web through version 5.80.0 and xo-server through version 5.84.0, contains a critical authorization bypass vulnerability in its WebSocket implementation. The vulnerability was discovered on April 5, 2021, and affects the permission enforcement mechanism through WebSockets, allowing unprivileged users to escalate their privileges (GitHub Issue, NVD).

The vulnerability stems from improper authorization handling in the WebSocket API implementation. Specifically, the application relies on client-side permission responses that can be manipulated. When using the 'resourceSet.getAll' method, the API responds with a permission level that can be modified from 'none' to 'admin' on the client side. This modification persists through subsequent API calls until the resourceSet.getAll method is called again (GitHub Issue).

The vulnerability allows an unprivileged user with basic access to elevate their permissions and gain unauthorized access to sensitive data sets including VMs, Backups, Audit logs, Users, and Groups information. This represents a significant breach of access control and data confidentiality (CISA).